ISO 27001 is the international standard for information security management, and the most rapidly growing certification requirement in UK enterprise and public-sector procurement. If your sales process consistently stalls at the security questionnaire stage, this is where that friction ends.
UniCert carries out ISO 27001 certification audits; UAF accreditation for ISO 27001 is in progress, and the accreditation status that applies to your certificate is confirmed in writing with every quote.
What is ISO 27001 and why does your business need it?
ISO/IEC 27001:2022 provides a framework for systematically identifying information security risks and implementing controls to manage them. It covers the confidentiality, integrity and availability of information assets — from customer data and intellectual property to IT systems and supply-chain access.
UK businesses pursue ISO 27001 for enterprise procurement requirements (a single certificate replaces hundreds of questionnaire hours), public sector and defence supply chain (DEFCON 658, NHS frameworks) and regulatory alignment with UK GDPR and the Cyber Governance Code of Practice.
ISO 27001 vs Cyber Essentials: which does your business need?
| Cyber Essentials | ISO 27001 | |
|---|---|---|
| Scope | 5 basic technical controls | Full information security management system |
| Assessment | Self-assessment + scan | Full independent audit |
| UK government contracts | Personal-data contracts | Higher-risk contracts |
| Time to achieve | 4–8 weeks | 4–10 months to implement, then 6–10 weeks to certify |
| Certification cost | £300–£500 | Initial certification from £1,000 (UniCert) |
| Recognition | UK-focused | International |
For most UK businesses targeting both public-sector and enterprise clients, holding both is the most commercially effective position. Cyber Essentials gets you to the starting line; ISO 27001 takes you to the front.
How much does ISO 27001 certification cost?
| Company size | Initial certification fee (from) |
|---|---|
| Under 10 employees | From £1,000 |
| 11–50 employees | From £1,400 |
| 51–200 employees | From £2,600 |
| 200+ employees | Contact us |
Annual surveillance audits start from £700. These are certification-body fees only: implementation effort, tooling and any consultant you hire are separate.
See the full ISO 27001 cost guideWill your client's security team accept the certificate?
- Ask for the exact wording: "ISO 27001 certified", "accredited certification", "UKAS or equivalent" or "UKAS only".
- Check whether the requirement is for the certificate itself or for answers to a security questionnaire; many enterprise buyers accept either.
- Send us the requirement before you commit; we confirm in writing which accreditation applies to your certificate.
